/**
 * `olam auth upgrade` — rebuild the olam-auth image and force-recreate the container.
 *
 * Steps:
 *   bash build-auth.sh (rebuilds olam-auth:local with latest source + git SHA)
 *   docker stop olam-auth + docker rm olam-auth
 *   olam auth up logic (docker run with correct env vars via AuthContainerController)
 *   wait for /health
 *   smoke test: POST /credentials/add provider=codex must NOT return a Claude URL
 */
import type { Command } from 'commander';
import { type DockerImpl, type ImageDigests } from './bootstrap.js';
export interface AuthUpgradeOpts {
    readonly yes: boolean;
    readonly skipRecreate: boolean;
    /**
     * Phase C — C6: opt into the legacy source-build path for auth-service.
     * Only works when isDevMode() is true. Default false → pull
     * `olam-auth@sha256:<digest>` from ghcr.io and recreate.
     */
    readonly fromSource: boolean;
}
/** Normalise raw Commander option object into typed opts. */
export declare function parseAuthUpgradeOpts(raw: {
    yes?: boolean;
    skipRecreate?: boolean;
    fromSource?: boolean;
}): AuthUpgradeOpts;
/**
 * Check cwd looks like the olam repo root for auth-service.
 * Verifies packages/auth-service/Dockerfile exists.
 */
export declare function validateAuthRepoRoot(cwd: string): {
    ok: true;
} | {
    ok: false;
    error: string;
};
/** Block until auth service /health responds OK or timeout expires. */
export declare function waitForAuthHealth(timeoutMs?: number): Promise<boolean>;
/**
 * Smoke test: POST /credentials/add with provider=codex.
 *
 * Passes when the response does NOT contain a claude.com/claude.ai loginUrl.
 * A stale (pre-codex) image falls through to the Claude PKCE branch and
 * returns a claude.com URL — this gate catches that.
 */
export declare function smokeTestCodexProvider(authSecret: string | null): Promise<{
    ok: true;
} | {
    ok: false;
    error: string;
}>;
/**
 * Phase C — C6: default `olam auth upgrade` flow for installed CLIs.
 *
 * Pulls `olam-auth@sha256:<digest>` from ghcr.io (via bootstrap.ts's
 * retry-throttle-coalesce helper), runs the protocol-version handshake,
 * re-tags to `olam-auth:local` (the canonical tag the
 * AuthContainerController expects), then docker stop + docker rm +
 * controller.start() — same recreate path as the legacy --from-source
 * flow uses post-build.
 */
export interface AuthUpgradePullDeps {
    readonly docker?: DockerImpl;
    readonly digests?: ImageDigests;
    readonly registry?: string;
    /**
     * Recreate driver. Default: stop + rm + AuthContainerController.start
     * + waitForAuthHealth. Tests stub to avoid real docker calls.
     */
    readonly recreateAuth?: () => Promise<{
        ok: boolean;
        error?: string;
    }>;
    /** Test-only: skip the docker-tag step (e.g. when injecting). */
    readonly tagImpl?: (from: string, to: string) => {
        ok: boolean;
        error?: string;
    };
}
export interface AuthUpgradePullResult {
    readonly exitCode: number;
    readonly summary: string;
}
export declare function runAuthUpgradePullByDigest(deps?: AuthUpgradePullDeps): Promise<AuthUpgradePullResult>;
export declare function registerAuthUpgrade(auth: Command): void;
//# sourceMappingURL=auth-upgrade.d.ts.map